❔ About
As many organizations, we have to develop & maintain (aka. BUILD & RUN) common software.
☝️ This process involves a lot of things that have to be achieved... (if you want to get a robust and secured software release pipeline).
I'll showcase here how we achieved all theses challenges on a common Java library dedicated to logging :
opt-nc / opt-logging
La librairie de référence pour générer des logs bien formatées à l'OPT.
❔ opt-logging
Cette librairie contient les 2 fichiers de configuration de logback préconisés pour les développements d'application à l'OPT-NC.
Toutes les logs sont dans le même fichier .log (${LOG_FILE}) à l'exception des logs métiers qui se trouvent dans un seul fichier .json (${LOG_FILE_JSON}) si le besoin est exprimé.
⬇️ Import de la dépendance publique
Cette dépendance est disponible publiquement via Jitpack.
🪶 Maven
Ajouter la repo Jitpack :
<repositories> <repository> <id>jitpack.io</id> <url>https://jitpack.io</url> </repository> </repositories> Puis la dépedance :
<dependency> <groupId>com.github.opt-nc</groupId> <artifactId>opt-logging</artifactId> <version>Tag</version> </dependency> 🐘 Gradle
Ajouter la repo :
allprojects { repositories { ... maven { url 'https://jitpack.io' } } } Puis la dépendance :
dependencies { implementation 'com.github.opt-nc:opt-logging:Tag' } 
Import de la dépendance via
…🏎️ Time to Market
Software release pipeline gains everyday a shorter Time To Market.
In fact there is no real option :
maintenance & release tasks have to be drastically automated... and should embed security concerns on the left side of the pipeline.
🛡️ Security
We have three complementary ways of achieving security tasks on our pipeline :
- Dependabot alerts : so we get Pull Requests to notify us what are the risks
-
CodeQLScan as part of GitHub Advanced Security (aka. GHAS) - Docker Image scan (see previous dedicated post)
Then to release software we rely on semantic-release to implement a solid Semantic Versioning scheme and get a
fully automated version management and package publishing pipeline.
🍿 Démo
Here is the full secured & automated release process 👇
🧰 Stack
🔖 Related contents
⛯ Scan Docker images 🛡️
🔂 Semantic release demo 🎞️
Semantic release intro demo :
Top comments (0)